TrendHow to create the perfect fake identity

Talk about a chilling scenario. IT security maven Bruce Schneier offers one: Imagine you are in charge of infiltrating sleeper agents into the United States. The year is 1983, and the proliferation of identity databases is making it increasingly difficult to create fake credentials. Ten years earlier, in 1973, someone could have just shown up in the country and gotten a driver’s license, Social Security card, and bank account — possibly using the identity of someone roughly the same age who died as a young child — but it is getting harder. You know that trend will only continue. So you ecide to grow your own identities.

Schneier calls it “identity farming.” You invent a handful of infants. You apply for Social Security numbers for them. Eventually, you open bank accounts for them, file tax returns for them, register them to vote, and apply for credit cards in their name. Now, twenty-five years later, you have a handful of identities ready and waiting for some real people to step into them.

There are some complications, of course. Maybe you need people to sign their name as parents — or, at least, mothers. Maybe you need to doctors to fill out birth certificates. Maybe you need to fill out paperwork certifying that you are home-schooling these children. You will certainly want to exercise their financial identity: depositing money into their bank accounts and withdrawing it from ATMs, using their credit cards and paying the bills, and so on. And you will need to establish some sort of addresses for them, even if it is just a mail drop. You will not be able to get driver’s licenses or photo IDs on their name. This is not critical, though; in the United States, more than twenty million adult citizens do not have photo IDs. Other than that, though, Schneier says he cannot think of any reason why identity farming would not work.

Schneier says we have to ask ourselves the real question: Do we actually have to show up for any part of our lives?

“I made this all up,” Schneier writes. “I have no evidence that anyone is actually doing this. It’s not something a criminal organization is likely to do; twenty-five years is too distant a payoff horizon. The same logic holds true for terrorist organizations; it’s not worth it. It might have been worth it to the KGB — although perhaps harder to justify after the Soviet Union broke up in 1991 — and might be an attractive option to existing intelligence adversaries like China.”

There may be other reasons why people would engage in identity farming (or identity gardening?): Immortals could also use this trick to self-perpetuate themselves, inventing their own children and gradually assuming their identity, then killing their parents off. They could even show up for their own driver’s license photos, wearing a beard as the father and blue spiked hair as the son (readers would not that this is not too far from plots popular in Highlander fan fiction). “The point is not to create another movie plot threat, but to point out the central role that data has taken on in our lives,” Schneier writes. “Previously, I’ve said that we all have a data shadow that follows us around, and that more and more institutions interact with our data shadows instead of with us. We only intersect with our data shadows once in a while — when we apply for a driver’s license or passport, for example — and those interactions are authenticated by older, less-secure interactions. The rest of the world assumes that our photo IDs glue us to our data shadows, ignoring the rather flimsy connection between us and our plastic cards.”

Schneier concludes: “It seems to me that our data shadows are becoming increasingly distinct from us, almost with a life of their own. What’s important now is our shadows; we’re secondary. And as our society relies more and more on these shadows, we might even become unnecessary. Our data shadows can live a perfectly normal life without us.”